OpenClaw: Zalo channel downloads media before sender authorization
## Summary The Zalo image path fetched and stored inbound media before the DM/pairing authorization checks ran. ## Impact Unauthorized senders could force network fetches and disk writes in the inbound media store even when the message itself was rejected. ## Affected Component `extensions/zalo/src/monitor.ts` ## Fixed Versions - Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `68ceaf7a5f` (`zalo: gate image downloads before DM auth`). OpenClaw thanks @AntAISecurityLab for reporting.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-33576US | —OT elevated | — | ||
OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writ… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/68ceaf7a5f64a23e78b95eff055e4b497218312aWEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-v2v2-f783-358jWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-33576ADVISORY
- https://www.vulncheck.com/advisories/openclaw-unauthorized-media-download-via-zalo-channelWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan